1. Field of the Invention
The invention relates the transferring of data from a source medium without altering the contents of the source medium.
2. Description of Related Art
Computers have become ubiquitous in modern society. Students use computers for research and writing, artists use computers for drawing, and so on. The vast majority of people use computers for beneficial purposes. However, computers may also be put to malicious use. Criminals of all kinds use computers to further their goals. White collar criminals may use computers to steal private banking or financial information from companies and individuals. Sex offenders may use computers to view illegal pornography and entrap children and adults in illegal schemes. Terrorists may use computers to plan evil acts. Just as the list of beneficial uses of computers is endless, so is the list of malicious and criminal uses.
Most computers include a hard disk to store data. When a computer is used for criminal purposes, evidence of the offender's criminal acts may be stored on the hard disk. Investigative agencies such as police, secret service, district attorney, Federal Bureau of Investigation and other organizations may obtain an offender's computer as evidence of criminal activity. In such circumstances, the integrity of the evidence on the hard disk of the offender's computer must be maintained while the data on the hard disk is examined for evidence of malicious acts. That is, investigators must preserve the content of the hard disk as of the time the hard disk was taken into evidence while the investigators evaluate the contents of the hard disk.
However, in personal computers running versions of Microsoft Windows and many other operating systems, when a hard disk is accessed in any way, the operating system writes various files to the hard disk. As such, if a suspect's hard disk is removed from a suspect's computer and installed in an investigator's computer, the investigator's computer writes information to the hard disk, thus altering the contents of the hard disk and compromising the evidentiary value of the hard disk. Various operating systems write data to storage devices when performing reads or otherwise accessing the storage devices. In addition, the investigator might inadvertently copy or move files, or otherwise make alterations to the drive under investigation.